> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/secrets/hashicorp/troubleshoot/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Troubleshoot Hashicorp issues

> Resolve common Hashicorp Vault integration issues

on-prem only

## Troubleshoot

Itential Platform can encounter difficulties when connecting to HashiCorp Vault servers that use HTTPS. In such cases, the following error message is often logged by Itential Platform:

`UNABLE_TO_VERIFY_LEAF_SIGNATURE`

This occurs when Itential Platform does not recognize or cannot access the SSL certificate chain used by the affected Vault servers.

## Add the Vault certificate chain to Platform

To fix this issue, perform the following steps on all Platform servers in your environment.

### Create the certificate file

Create a file named `vault.cert` on your Platform server.

```bash
touch vault.cert
```

### Add certificate contents

Copy the contents of all SSL certificates used by Vault to the `vault.cert` file. For example, if your Vault server uses an end-user certificate, an intermediate certificate, and a root certificate, the resulting `vault.cert` file should look similar to the following:

```text
-----BEGIN CERTIFICATE-----
<Content of end-user certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<Content of intermediate certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<Content of root certificate>
-----END CERTIFICATE-----
```

### Move the certificate file

Move the `vault.cert` file to the `/etc/pki/tls/certs` directory.

```bash
mv ./vault.cert /etc/pki/tls/certs
```

### Set ownership

Assign ownership of the `vault.cert` file to the `itential` user.

```bash
chown itential: /etc/pki/tls/certs/vault.cert
```

### Set permissions

Make sure the `itential` user has read-only access to the `vault.cert` file. No access should be granted to any groups or other users (numeric permission `400`).

```bash
chmod 400 /etc/pki/tls/certs/vault.cert
```

### Locate the service file

Determine the location of the Platform service file `itential-platform.service` by executing the `systemctl status itential-platform` command. In the following example, the service file is located at `/usr/lib/systemd/system/itential-platform.service`.

```bash
[root@localhost itential]# systemctl status itential-platform 
● itential-platform.service - Itential Platform Service
    Loaded: loaded (/usr/lib/systemd/system/itential-platform.service; enabled; vendor preset: disabled)
    Active: active (running) since Wed 2023-08-30 14:45:32 EDT; 1 weeks 4 days ago
Main PID: 812873 (Pronghorn core)
    Tasks: 302 (limit: 36528)
    Memory: 3.5G
    CGroup: /system.slice/itential-platform.service
        ├─812873 Pronghorn core
        ├─812955 Pronghorn AppArtifacts Application
        ├─812983 Pronghorn AutomationCatalog Application
        ├─812991 Pronghorn AutomationStudio Application
```

### Add environment variable

Add the following environment variable to the `itential-platform.service` file. This gives Platform access to the `vault.cert` file that now contains your Vault certificate chain.

```bash
Environment="NODE_EXTRA_CA_CERTS=/etc/pki/tls/certs/vault.cert"
```

### Reload daemon

Reload the service daemon for the changes to take effect.

```bash
systemctl daemon-reload
```

### Restart Platform

Restart the Itential Platform service.

```bash
systemctl restart itential-platform
```

## Further Reading

For more information about integrating HashiCorp Vault with Itential Platform, refer to the [HashiCorp Vault Encryption](/itential-platform/secrets/hashicorp/overview) section of the documentation.

> Resolve common Hashicorp Vault integration issues